With CMMC rolling out, this list of seven programs could touch 700 companies The Defense Department has now released an initial group of contracts that will require the third-level certification out of five under the Defense Department's new CMMC cyber standards for contractors. The Cybersecurity Maturity Model Certification is DOD’s effort to get contractors to verify how they protect government information that resides in their systems. CMMC will apply to tens of thousands of contractors, so DOD is implementing a phased-in approach. We have seen CMMC pop up in other contracts as it has already been included as a requirement in the General Services Administration's Polaris and 8(a) STARS III small business vehicles.